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AIRFRAME  CERTIFICATION  METHODS 

The  application  of  conventional  structural  certification  methods  to  unmanned  aircraft  can  lead  to 
unacceptably  long  development  times  and  costs  that  are  out  of  line  with  the  development  costs  for  the 
airframe.  Moreover,  such  certification  methods  often  close  the  door  on  new  technologies  that  could  reduce 
the  weight  and  cost  of  the  vehicle  simply  because  these  technologies  are  not  yet  qualified  for  flight  vehicles. 
The  aircraft  development  community  needs  a  different  approach  toward  certification  of  these  vehicles  that 
ensures  reliability  and  safety  in  flight,  but  requires  less  testing  than  the  conventional  building  block  approach 
used  to  achieve  these  goals. 

The  Boeing  Company  has  had  the  unique  opportunity  to  develop  unmanned  vehicles  for  a  variety  of 
customers,  applications,  and  missions  over  the  past  few  years.  From  vertical  take-off  to  hypersonic  aircraft, 
from  flight  demonstration  vehicles  to  operational  aircraft,  Boeing  has  developed  these  aircraft  for  DARPA, 
the  Army,  the  Navy,  the  Air  Force,  and  NASA.  The  customer  requirements,  the  qualification  and  certification 
requirements,  and  the  mission  requirements  have  determined  the  breadth  of  technologies  available  for  these 
aircraft.  This  paper  will  summarize  these  various  requirements  and  how  they  impacted  the  design  space, 
structural  concepts,  and  material  selections  for  these  aircraft.  This  summary  will  be  the  foundation  for  a 
recommended  approach  toward  certification  of  unmanned  aircraft  structures  based  on  the  intended  mission 
(single  flight  demonstration,  multiple  flight  demonstrations,  limited  operational  usage,  or  full  operational 
usage). 

The  recommended  approach  for  structural  certification  of  these  vehicles  reflects  its  development  cost,  the 
lifetime  of  its  service,  and  the  performance  requirements  of  its  mission.  Thus  it  will  offer  the  ability  to  tailor 
the  certification  approach  according  to  the  projected  vehicle  usage.  In  addition  it  will  provide  a  means  for 
defining  additional  tests  or  analyses  to  aid  in  the  user  in  certifying  such  aircraft  for  missions,  lifetimes,  or 
performance  capabilities  above  and  beyond  its  original  design  parameters.  The  approach  will  be  bounded  by 
the  1.25  static  factor  of  safety  proof  tests  used  for  single  flight  missile  systems  and  the  building  block 
approach  used  with  a  1.5  static  factor  of  safety  to  certify  composite  aircraft  structures  for  today's  military 
aircraft.  Results  from  the  Air  Force  Composites  Affordability  Initiative  ( CAI)  are  presented  that  demonstrate 
how  to  reduce  testing  while  meeting  structural  requirements. 
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1.0  INTRODUCTION 

Certification  of  unmanned  vehicles  poses  a  unique  set  of  problems.  These  vehicles  come  in  a  wide  variety  of 
types  and  usages.  As  shown  in  Figure  1  just  they  run  from  shoe-box  size  aircraft  to  aircraft  larger  than  most 
manned  fighters.  But  these  vehicles  were  originally  designed  to  demonstrate  a  specific  usage: 

Some  are  one  time  use  (missiles  or  drones), 

Some  are  reconnaissance, 

Some  are  bombers, 

Some  are  strike  platforms, 

Most  have  had  their  original  use  expanded  to  encompass  other  needs. 


Figure  1.  Unmanned  Air  Vehicles  Cover  a  Wide  Breadth  of  Sizes  and  Usages 

Most  of  today’s  unmanned  vehicles  were  flight  qualified  -  not  certified.  They  were  proof  tested  to  ensure 
major  component  integrity  for  flight.  Because  they  are  now  multi-use  vehicles  there  is  a  desire  to  demonstrate 
their  capability  to  meet  the  requirements  for  their  usages  -  but  users  generally  cannot  justify  the  cost  to  certify 
the  structures  for  low  cost  vehicles.  In  order  to  qualify  these  vehicles  for  flight  very  low  cost  methods  were 
required  to  verify  their  structural  integrity,  not  the  intensive  test  methodologies  used  for  certification  for 
production  programs  (Figure  2).  There  is  no  extensive  building  block  program  or  subcomponent  risk 
reduction. 
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Figure  2.  Simpler  Test  Methods  Must  Be  Used  to  Certify  Unmanned  Vehicles. 

Another  part  of  the  problem  is  that  unmanned  aircraft  do  not  yet  have  a  specific  role  in  today’s  air  force.  We 
are  still  demonstrating  and  exploring  the  capabilities  of  these  aircraft.  Thus  the  roles  of  these  aircraft  are 
expanding  into  additional  usages.  Moreover,  the  demonstrated  capabilities  have  created  the  desire  to  use  these 
vehicles  in  the  battlefield.  In  addition  some  have  moved  into  limited  rate  production  without  certification  in 
the  traditional  sense.  Two  well  known  examples  of  this  path  to  production  are  shown  in  Figure  3.  Because  of 
these  issues,  unmanned  aircraft  have  defined  set  of  certification  criteria  against  which  they  can  be  certified. 


Figure  3.  Global  Hawk  and  Predator  are  examples  of  unmanned  aircraft  that  went  into  limited  operation  before 

being  certified  by  conventional  structural  test  methods. 

Because  the  flight  structures  of  these  aircraft  are  low  cost,  operators  often  cannot  justify  the  cost  of  traditional 
certification  approaches.  Often  the  loss  of  a  vehicle  would  not  justify  the  test  cost  to  preclude  its  loss.  This  is 
particularly  true  for  the  very  low  cost  end  of  the  unmanned  vehicle  spectrum,  like  those  shown  in  Figure  4. 
Thus  the  problem  we  want  to  address  in  this  paper  can  be  stated  as  We  need  a  low  cost  method  that  certifies 
unmanned  vehicles  for  service  that  can  be  performed  at  very  cost  to  the  operator . 
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Figure  4.  Very  low  cost  unmanned  air  vehicles 


There  is  a  very  important  second  facet  of  this  problem.  Certification  requirements  (and  design  criteria) 
depend  on  projected  use.  Missiles  and  release-and-forget  drones  are  typically  qualified  using  lower  factors  of 
safety  than  aircraft.  Prototype  aircraft  are  qualified  using  tests  that  check  major  assemblies  -  often 
performed  on  flight  hardware. 

Production  aircraft  are  certified  using  airframes  set  aside  for  that  purpose.  The  process  ensures  that  aircraft 
built  to  the  specifications  will  perform  as  designed  throughout  its  service  lifetime.  Unmanned  vehicles  pose  a 
unique  problem  in  that  most  have  started  out  as  prototype  aircraft  used  to  demonstrate  a  certain  capability, 
then  have  had  their  use  expanded  in  service.  So  a  second  statement  of  the  problem  is  that  We  need  a  low  cost 
method  that  can  certify  the  structure  for  the  design  realm  for  which  the  vehicle  is  intended  -  prototype , 
design! demonstration,  limited  operational  usage ,  or  full  production  and  fielded  service.  These  usages  are 
radically  different  and  their  certification  methods  need  to  be  different  and  scaled  to  the  projected  usage. 

As  we  consider  the  certification  methods  for  these  aircraft  it  is  important  to  remember  that  the  intent  of  the 
certification  process  is  to  reduce  the  risk  for  the  user  to  fly  the  vehicle  in  his  operational  environment  and 
accomplish  the  mission  intended,  Reference  1.  With  that  in  mind,  it  is  helpful  to  recall  that  the  amount  of  new 
technology  that  can  be  accepted  at  low  risk  varied  with  the  maturity  of  the  vehicle  being  developed.  As 
shown  in  Figure  5,  a  prototype  vehicle  that  will  not  be  subjected  to  a  rigorous  certification  test  program  might 
be  able  to  accept  technologies  that  a  more  mature  production  aircraft  project  could  not  accept  without  a 
complete  risk  reduction  and  certification  program. 


1.1  -4 


RTO-MP-AVT -1 45 


UNCLASSIFIED/UNLIMITED 


UNCLASSIFIED/UNLIMITED 

Airframe  Certification  Methods  for  Unmanned  Aircraft 


Product  Development  Phases 

Technology 

Readiness 

Level 

Readiness  Level  Definition 

Concept 
Exploration 
&  Definition 

Demonstration/ 

Validation 

Engineering  / 
Manufacturing 
Development 

Production/ 

Deployment 

Operations/ 

Support 

9 

Production  Flight  Proven 

8 

Flight  Test  Qualified 

No  Risk 

7 

Full  Scale  Ground  Test 

6 

Component  Level  Ground  Test 

Low  Risk 

Medium  Risk 

High  Risk 

5 

Subcomponent  Ground  Test 

4 

Panel  Level  Testing 

3 

Proof  of  Concept  Testing 

Unacceptable 

2 

Concept/Application  Identified 

Risk 

1 

Basic  Principles  Reported 

Unmanned  Air  Vehicles 
Have  Been  Limited 
to  This  Reaime 


Figure  5.  Most  Unmanned  Aircraft  Currently  Exist  in  the  Prototype  and 
Limited  Operational  Usage  Mode. 


Because  these  aircraft  were  prototypes  and  technology  demonstration  vehicles,  they  could  accommodate 
technologies  that  were  not  mature  enough  for  production  programs  at  this  time.  This  leads  to  the  third  facet  of 
the  problem. 

Certification  requirements  (and  design  criteria)  determine  the  maturity  of  the  materials  and  structural  concepts 
used  in  development  of  the  vehicles.  Prototypes  can  often  use  materials  and  structures  that  have  low 
technology  readiness  levels.  They  are  not  certified  but  must  meet  flight  qualification  criteria  (by  test  or 
similarity).  More  important  they  are  qualified  using  the  flight  hardware  and  so  the  results  of  these  tests  reflect 
on  the  design,  the  fabrication  process,  and  the  manufacturing  capability  used  with  these  materials  and 
structures.  But  the  test  includes  them  all  without  relying  on  the  building  block  approach  so  often  used  to 
assess  production  aircraft  because  the  cost  to  certify  each  production  aircraft  would  be  excessive.  Production 
aircraft  are  certified  using  test  airframes  and  results  are  linked  back  to  element  tests  that  have  statistical 
confidence  levels  and  knock-downs  that  account  for  flight  conditions  (allowables).  It  is  through  tests  of  a  few 
vehicles  put  through  many  load  conditions  that  production  aircraft  are  certified  and  that  certification  removes 
risk  for  applying  the  aircraft  to  the  full  range  of  service  usage  to  which  the  aircraft  was  designed. 

Unmanned  vehicles  pose  a  unique  problem  in  that  most  have  started  out  as  prototype  aircraft  used  to 
demonstrate  a  certain  capability,  then  have  had  their  use  expanded  in  service.  Moreover,  there  is  a  desire  to 
provide  a  method  that  accommodates  low  rate  production  -  that  is  sensitive  to  the  difference  between 
prototype,  limited  service  usage  and  full  production  and  service  usage.  This  leads  us  back  to  a  third  variation 
of  the  original  problem  statement.  We  need  a  low  cost  method  that  certifies  multi-use  vehicles  for  service 
that  is  flexible  enough  to  meet  changing  customer  needs . 
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2.0  AN  EXAMPLE 

Before  going  on  into  the  proposed  solution  for  this  problem,  let’s  examine  a  case  history  that  helps  to  illustrate 
the  point  that  the  certification  process  can  define  the  materials  and  structures  used  on  unmanned  (or  manned) 
vehicles.  In  the  case  of  Boeing’s  X-45A  a  number  of  new  technologies  were  flown  on  these  two  technology 
demonstration  aircraft.  These  new  technologies  included  low  temperature  melt  composite  resins  systems  and 
foam  core  sandwich  wings,  as  shown  in  Figures  6  and  7,  Reference  2. 

These  technologies  were  not  mature  at  the  time  that  they  were  selected  for  use  on  these  aircraft  -  there  were 
no  ‘allowables  developed,  nor  other  flight  vehicles  flying  at  the  time,  although  there  were  several  in 
development  that  were  examining  their  use  at  that  time.  It  these  technologies  had  been  forced  to  go  through 
the  typical  exhaustive  materials  qualification  process  or  to  have  been  put  through  the  building  block 
certification  process,  they  could  not  have  been  used  for  the  time  and  cost  would  have  been  prohibitive.  But, 
because  they  were  being  considered  for  use  on  prototype  vehicles  that  would  each  be  ground  test  qualified 
before  flight  -  regardless  of  whether  they  used  these  new  material  systems  or  not  -  we  could  implement  these 
new  systems  using  limited  tests  to  determine  ‘design  values.’ 


Plies  Being  Bagged 


Lay-up  Being  De-Bulked 


Optical  Laser  | 
Templates 


Figure  6.  Ply  layup  for  low  temperature  melt  composite  system  for  X-45A 
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Figure  7.  Development  of  the  sandwich  core  wing  composite  system  for  X-45A 

While  we  could  accept  greater  risk  for  advanced  technologies  in  demonstrators  and  prototypes  in  accordance 
with  the  assessment  shown  in  Figure  8,  the  maturity  of  these  systems  was  much  lower  than  would  be  normally 
acceptable.  Using  the  risk/readiness  assessment  tool  developed  under  the  D  ARP  A/Navy/Boeing  AIM-C 
Program,  the  risk  levels  for  probability  to  fail  the  ground  test  was  determined  to  be  about  99%,  if  these 
systems  were  used  without  other  efforts  in  parallel. 
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Figure  8.  AIM-C  technology  readiness  assessment  process  applied  to  new  technologies  for  X-45A 

But,  the  program  performed  two  tasks  that  significantly  reduced  the  risk  to  the  program  itself.  To  reduce  this 
risk  of  structural  failure  for  these  components: 

Design  ultimate  loads  were  increased  by  125%  beyond  limit  load  (1.25  factor  of  safety  x  1.25 
additional  factor).  This  decreased  the  risk  of  failing  under  peak  flight  loads  from  95%  to  25%  (Based  on 


RTO-MP-AVT-145 


1.1  -7 


UNCLASSIFIED/UNLIMITED 


UNCLASSIFIED/UNLIMITED 


Airframe  Certification  Methods  for  Unmanned  Aircraft 


ORGANIZATION 


historical  certification  data).  And, 

Every  wing  component  was  proof  tested  to  80%  of  limit  load.  This  decreased  the  risk  of  failing  under 
peak  flight  loads  to  less  than  1%  (Because  the  proof  load  encompassed  the  flight  loads) 

Thus  the  risk  to  the  program  was  mitigated  and  these  technologies  were  used  safely  and  with  good  confidence. 
If  this  airframe  had  been  forced  to  apply  conventional  building  block  certification  processes  and  standard 
material  qualification  processes,  these  technologies  could  not  have  been  used.  We  would  have  had  to  fall 
back  to  previously  qualified  material  systems  and  previously  certified  structural  concepts.  While  the 
performance  and  capabilities  of  the  aircraft  might  not  have  been  affected  by  this  change,  the  knowledge  of 
these  two  new  technologies  would  not  have  been  gained.  Thus  we  need  something  between  the  flight 
qualification  process  used  for  prototype  aircraft  and  the  rigorous  and  expensive  conventional  certification 
process  that  would  apply  to  the  limited  operational  usage  seen  by  today’s  unmanned  air  vehicles. 

We  need  a  low  cost  method  that  can  certify  the  structure  for  the  design  realm  for  which  the  vehicle  is 
intended  -  prototype ,  design/demonstration ,  limited  operational  usage ,  or  full  production  and  fielded 
service. 

3.0  A  PROPOSED  ALTERNATIVE 

Based  on  the  problem  statement  presented  and  the  example  given,  there  are  some  ground-rules  we  can  give 
for  the  formulation  of  a  certification  process  for  unmanned  air  vehicles.  The  certification  process  needs  to 
include  the  following  elements: 

1)  Take  into  account  the  flight  qualification  data  already  developed 

2)  Encompass  the  range  of  usage  for  which  the  vehicle  is  being  proposed 

3)  Cost  less  than  two  airframe  structures  -  Traditional  certification  costs  run  at  least  6  times  the  cost 
of  an  airframe  -  often  more. 

4)  Reflect  the  design  criteria  used  and  the  use  of  design  values  (not  B -Basis  allowables  in  many 

cases) 

5)  Recognize  that  the  certification  process  many  reduce  the  envelope  of  loads,  usage,  or  technologies 
available. 


As  shown  in  Figure  9,  the  conventional  building  block  approach  to  aircraft  certification  covers  a  broad 
spectrum  of  usage  and  environments,  many  of  which  are  rarely  seen  by  most  of  the  flight  vehicles.  The 
certification  approach  recommended  herein  is  one  that  uses  a  stepped  progression  from  the  prototype  vehicles 
to  the  production  vehicles  and  does  no  more  testing  at  any  step  than  what  is  needed  to  assure  safe  flight  and 
operation  of  the  vehicle  as  it  progresses  from  the  prototype  vehicle  to  the  production  of  fielded  operational 
vehicle,  Reference  3.  It  offers  an  intermediate  step  that  allows  the  user  to  qualify  the  aircraft  for  limited 
operational  usage  with  much  less  testing  that  is  performed  for  full  operational  usage,  but  more  testing  than  is 
used  for  the  prototype  vehicle.  The  intermediate  step  is  focused  on  assuring  that  the  vehicle  will  operate 
safely  in  limited  operational  environment  for  a  reduced  lifetime  consistent  with  that  operation. 
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Notice  also  that  the  certification  approach  is  linked  to  the  factors  of  safety  used  in  the  design.  It  starts  with  a 
design  ultimate  load  factor  consistent  with  those  which  are  used  for  vehicles  certified  by  analysis  alone.  It 
would  be  anticipated  that  the  flight  envelop  for  such  a  vehicle  might  be  held  to  less  than  half  of  this  load  for 
the  prototype  demonstration  fights,  Reference  4.  As  the  program  goes  into  limited  operational  status,  the  load 
factors  would  be  allowed  to  increase  and  the  test  loads  would  encompass  those  anticipated  for  operational 
usage,  but  without  testing  the  factor  of  safety  to  ultimate.  The  testing  for  limited  operational  usage  would  also 
include  fatigue  testing  to  two  lifetimes  of  the  limited  lives  expected  for  the  vehicles  and  would  be  performed 
on  the  same  test  article  that  is  used  for  the  static  testing.  Additional  GVT  testing  would  be  performed  during 
this  intermediate  stage  of  certification. 
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Figure  9.  A  comparison  of  the  breadth  and  expense  of  a  full  certification  approach  to 
a  stepped  spiral  certification  approach 


Testing  to  ultimate  load  is  reserved  for  the  full  production  certification  in  which  such  testing  is  used  to  not 
only  validate  the  ultimate  factor  of  safety,  but  also  to  encompass  variations  in  manufacturing  or  assembly  as 
well.  In  a  well  planned  program,  the  airframe  used  for  the  final  validation  of  the  structure  would  be  the  same 
airframe  used  for  the  limited  operational  aircraft.  However,  if  significant  changes  have  been  made  between 
these  generations,  then  additional  airframes  will  be  needed  to  accomplish  the  full  certification  test  program. 
But,  the  intent  of  this  path  is  to  link  the  flight  qualification  of  the  prototype  to  the  limited  operational 
certification  of  the  second  step  to  the  final  certification  of  the  operational  vehicle.  Thus  the  testing  required  to 
go  from  step  two  to  step  three  is  cut  by  half  or  more. 

It  is  interesting  to  note  that  the  proposed  certification  process  used  for  this  development  is  almost  the  direct 
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opposite  of  what  is  used  now  as  far  as  starting  with  small  coupons  and  growing  with  the  development  to  the 
overall  airframe.  This  spiral  certification  approach  is  more  aligned  with  the  process  of  aircraft  development 
than  with  structures  development,  as  shown  in  Figure  10.  Because  the  first  aircraft  is  assumed  to  be  a 
prototype  or  development  aircraft  it  is  assumed  that  it  will  be  qualified  for  flight  using  a  test  of  the  flight 
vehicle.  Subsequently  the  next  stage  uses  a  dedicated  airframe  to  establish  load  limits  and  lifetimes  beyond 
those  intended  fro  limited  operational  usage.  Then  the  final  spiral  takes  this  airframe  (or  one  more  like  the 
final  production  design)  and  runs  it  through  the  full  envelop  of  loads  required  to  certify  the  production 
vehicle.  And  subsequently  it  would  test  the  fatigue  life  and  damage  tolerance  of  the  design  in  the  same 
airframe. 


Conventional 


Spiral  Certification 


Builds  up  to  Full  Scale 
From  Materials 
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To  Critical  Details 
To  Subcomponents 
To  Components 
To  Full  Scale  Test 


Begins  With  Full  Scale 

Flight  Qualification 

Life  Extension 

Then  Critical  Details 
and  Allowables 


Figure  10.  The  spiral  certification  approach  is  run  almost  the  reverse  of  the  conventional  certification  approach 


In  constructing  this  spiral  certification  plan,  we  were  careful  to  retain  the  current  standards  for  certification  of 
airframes  when  testing  is  not  imposed.  That  is,  we  imposed  a  factor  of  safety  of  2  between  the  design  loads 
and  the  expected  flight  loads  for  prototype  aircraft  that  would  not  be  tested  other  than  a  flight  qualification 
test.  We  did  this  by  imposing  a  placard  on  the  flight  conditions  so  that  the  airframe  would  not  see  loads 
beyond  80%  design  limit  load.  That  factor  of  two  (or  nearly)  is  consistent  with  today’s  certification  process. 

As  shown  in  Figure  11,  we  also  imposed  that  a  full  scale  test  to  design  ultimate  load  would  be  applied  to 
ensure  that  the  airframe  would  meet  its  design  operating  conditions  for  service.  This  is  certainly  consistent 
with  current  design  and  certification  processes.  In  the  chart  we  chose  to  show  the  conditions  proposed  for 
unmanned  vehicles,  an  ultimate  factor  of  safety  of  1.25.  That  factor  of  safety  is  subject  to  discussion  and 
controversy,  but,  even  if  this  were  not  the  factor  of  safety  determined  for  use  in  unmanned  vehicles,  the 
process  would  not  be  impacted,  only  the  design  factor  of  safety  would  be  impacted  as  shown  in  Figure  9. 
Certainly,  the  design  ultimate  load  factor  of  1.25  is  consistent  with  missiles  and  other  unmanned  vehicles 
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flying  and  in  service  today. 
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Figure  11.  The  spiral  certification  approach  allows  consistency  between  current  practice  for  design  of  prototype 
vehicles  (little  analysis)  and  production  vehicles  (which  are  done  primarily  by  analysis) 


Design  Co 

nservatism 

Test  Validation 

Consisten 

Prototy 

t  with  Current 
pe  Practice 

Consist* 

Productioi 

mt  with 
i  Practice 

Spiral  1  Spiral  2  Spiral  3 


Further  descriptions  of  the  load  conditions  applied  in  each  stage  of  the  certification  process  are  defined  in 
Figure  12.  In  this  summary  we  included  the  load  conditions  most  often  used  to  qualify  a  prototype  aircraft  for 
flight:  A  proof  test  to  flight  loads  for  wing  attachments,  a  GVT  to  determine  that  systems  and  structures  are 
not  vibrating  close  to  natural  frequencies  of  the  structure,  taxi  tests  to  get  further  dynamic  load  conditions,  and 
flight  loads  monitoring  to  ensure  that  the  loads  recorded  for  various  flight  parameters  are  within  the  ranges 
predicted  analytically.  In  the  second  spiral  we  included  the  fabrication  of  an  airframe  dedicated  to  structural 
testing.  It  is  loaded  to  100%  design  limit  load  to  free  the  vehicle  to  fly  within  its  design  envelop.  We 
included  fatigue  testing  to  twice  the  limited  operational  usage  life  to  demonstrate  durability.  A  more 
extensive  ground  vibration  test  of  a  flight  vehicle  to  wring  out  systems  in  a  greater  array  of  environments 
(loaded  and  unloaded,  for  example).  And  flight  loads  would  again  be  monitored  to  ensure  that  flight 
conditions  did  not  exceed  the  bounds  imposed  by  the  reduced  level  of  static  testing  applied  to  the  airframe  in 
test. 

In  the  final  stage  of  certification  testing  shown  in  Figure  12,  we  would  complete  the  standard  testing  applied 
to  production  aircraft  in  their  certification  test  program.  This  would  include  taking  the  airframe  to  its  design 
ultimate  load  condition  after  an  extensive  fatigue  test  (from  twice  the  limited  operational  life  to  twice  the 
intended  service  life)  and  damage  tolerance  testing  to  one  lifetime  to  demonstrate  fatigue  life  capability  with 
flaws.  Finally,  the  design  ultimate  load  conditions  would  be  imposed  on  the  airframe.  At  the  same  time 
payload  and  stores  GVT  tests  would  be  performed  on  flight  vehicles  and  a  flight  loads  tracking  program 
would  be  initiated  in  order  to  provide  data  for  fleet  management  and  individual  aircraft  tracking. 
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Figure  12.  Further  definition  of  the  spiral  certification  approach. 


Throughout  all  of  these  stages  of  certification,  a  rigorous  approach  to  linking  the  system  level  requirements  to 
the  component  and  airframe  level  testing  would  be  imposed  so  that  the  level  of  testing  did  not  exceed  the 
design  conditions  to  be  imposed,  but  also  so  that  the  factors  of  safety  would  not  be  exceeded.  At  the  same 
time,  limits  imposed  on  the  prototype  and  limited  operational  vehicles  would  have  their  own  impacts  on  the 
system  operation  and  service  capabilities  that  would  be  fully  documented  and  followed  during  service.  This 
approach  is  shown  schematically  in  Figure  13,  in  which  requirements  at  each  stage  flow  down  from  the 
system  level  requirements  for  each  facet  of  the  vehicle  development  (prototype,  limited  operation,  and  full 
service  operation),  and  imposed  limitations  flow  back  up  to  he  systems  level  to  reflect  the  validated  level  of 
safe  flight  or  operation  to  which  the  vehicle  was  certified  in  that  stage,  Reference  5. 

There  are  two  primary  reasons  why  we  feel  that  the  proposed  certification  process  can  be  safely  applied  to 
develop  future  aircraft  systems  (particularly  unmanned  systems).  One  of  these  is  the  capabilities  of  our 
current  the  structural  analysis  tools,  Reference  6.  Tools  like  those  shown  in  Figure  14,  are  beginning  to  be 
validated  for  prediction  of  failure  modes  at  the  micro-scopic  and  nano-levels  of  behavior  in  our  structures.  As 
these  tools  are  demonstrated  to  predict  the  impact  of  those  failures  on  the  macroscopic  response  of  structures 
to  flight  load  conditions,  we  are  going  to  be  able  to  determine  exactly  what  testing  is  required  in  order  to 
validate  those  predictions  and  to  pin-point  exactly  what  coupons  develop  the  data  required  to  make  those 
predictions  accurate. 
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Figure  13.  Requirements  definition  must  be  consistent  between  system  level  and  component  level 
Structural  certification  and  materials  qualification  occurs  at  the  part  level. 
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Figure  14.  Analysis  capabilities  to  define  failure  at  lower  levels  of  scale  are  improving  dramatically  -  we  seek 
what  they  tell  us  of  failure  mechanisms  and  failure  mechanics 
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In  addition  to  the  accuracy  and  capabilities  of  our  analysis  tools,  we  are  also  beginning  to  exercise  our 
manufacturing  analysis  tools  (Figure  15)  to  tell  us  more  about  the  as-fabricated  state  of  the  materials  and 
structures  from  which  components  of  the  structure  are  made.  Soon  we  will  not  only  be  able  to  determine  the 
as-designed  strength  and  fatigue  life,  but  more  important,  the  strength  and  fatigue  life  of  the  as-manufactured 
parts  of  the  aircraft.  It  is  the  latter  which  defines  the  life  and  strength  of  the  vehicle  -  even  though  it  is  greatly 
influenced  by  the  design.  In  the  distant  past,  we  sought  to  model  the  as-designed  structure  with  tools  that 
were  scarcely  able  to  determine  anything  but  the  grossest  responses  of  the  structure,  later  we  advanced  to  the 
point  at  which  we  were  able  to  design  structures  very  well  with  the  analysis  tools  that  we  had,  but  we  then 
struggled  to  deliver  structures  that  mimicked  those  designs  within  some  tolerance  level.  In  the  future,  we  see 
that  the  design  analysis  and  manufacturing  processes  will  be  so  closely  tied  that  the  analysis  will  be  focused 
on  predicting  variations  in  strength  and  life  due  to  variations  in  the  as-manufactured  structures.  In  some 
instances  we  are  approaching  this  point  even  today. 
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Figure  15.  Analysis  capabilities  to  define  failure  at  lower  levels  of  scale  are  improving  dramatically  -  we  seek 

what  they  tell  us  of  the  state  of  the  as-manufactured  parts 


The  whole  purpose  of  both  the  recommended  certification  plan  and  the  development  of  advanced  and  accurate 
analysis  tools  is  to  achieve  safety  of  flight  in  advanced  aircraft  systems.  We  see  certification  methods  going 
away  from  testing  based  methods  supported  and  linked  by  analyses,  to  analysis  -based  methods  supported  by 
focused  testing  -  testing  defined  by  the  data  needs  of  the  analysis  tools  as  shown  schematically  in  Figure  16. 
In  the  latter  case  the  testing  will  not  be  done  to  supply  a  database  that  covered  the  entire  range  of  design  and 
environmental  conditions,  but  to  a  few  focused  tests  performed  to  ensure  that  the  analysis  methods  were 
accurate  in  areas  perhaps  not  completed  validated  previously.  One  would  not  have  to  completely  revalidate 
the  analysis  as  we  do  today  so  often  in  our  current  building  block  certification  process.  We  as  an  engineering 
community  are  not  there  yet,  but  we’re  getting  closer. 
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Figure  16.  The  goal  is  to  develop  analysis  capabilities  that  will  allow  us  to  certify  aircraft  by  analysis  grounded  in 

test,  rather  than  test  linked  by  analysis 

But,  the  certification  process  proposed  in  this  paper  does  not  depend  on  the  development  or  validation  of  these 
analysis  techniques  to  be  applied  effectively.  It  can  use  today’s  methods.  It  has  the  advantage  that  it  requires 
no  more  testing  than  is  required  today,  it  imposes  no  more  risk  to  safety  of  flight  than  today’s  methods,  but  it 
offers  much  lower  cost  to  certify  a  low  cost  vehicle  for  limited  flight  operations  than  today’s  methods  which 
impose  traditional  certification  processes  on  low  cost  airframes  and  at  a  price  which  eliminates  interest  in  their 
pursuit.  But,  even  more  important,  it  is  a  method  which  can  certify  the  structure  for  the  design  realm  for 
which  the  vehicle  is  intended  -  prototype ,  design/demonstration,  limited  operational  usage,  or  full 
production  and  fielded  service.  And  the  method  is  flexible  enough  to  change  with  changing  user  needs  as 
we  said  it  must  be. 
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